RMQTT

Search the Marketplace for RMQTT, select the SecureAnyCloud publisher, and select Create.

Configure the Network Security Group to allow TCP 8883 (MQTT/TLS) and TCP 22 for administration. Where you need them, also allow TCP 1883 (MQTT) and TCP 8080 (MQTT/WebSocket) from your client networks. Prefer 8883 for real traffic, and where possible limit plaintext 1883 to traffic inside the VNet.

RG="mqtt-prod"; LOCATION="eastus"; VM_NAME="mqtt1" IMAGE_URN="sac1647283583153:rmqtt-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:rmqtt-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open the MQTT and admin ports on the VM's NSG:
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 8883 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 1883 --priority 1002
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 8080 --priority 1003
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1004

On first boot, the image resolves the VM public IP, generates a per-VM MQTT password and a per-VM self-signed TLS certificate, writes the authentication backend credential, and starts the broker. This completes within a minute.

SSH in as azureuser and read the per-VM details, including the MQTT username and password:

sudo cat /root/rmqtt-credentials.txt

rmqtt.service and its authentication backend rmqtt-authd.service are active, and the broker listens on 1883 (TCP), 8883 (TLS) and 8080 (WebSocket).

systemctl is-active rmqtt.service rmqtt-authd.service ss -tln | grep -E ':1883|:8883|:8080'

The image ships a self-test that authenticates with the per-VM credential and completes a publish and subscribe message round trip on 1883. It confirms that a client with a wrong password and an anonymous client are both rejected, and completes a TLS handshake with an authenticated publish on 8883. Run it to verify that the broker is healthy and secure end to end:

sudo python3 /usr/local/lib/sac/rmqtt-roundtrip.py

The encrypted listener on 8883 presents the per-VM self-signed certificate. Inspect the handshake and certificate with openssl:

echo | openssl s_client -connect 127.0.0.1:8883 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Any standard MQTT client can connect with the per-VM username (mqttadmin) and password. The following examples use the bundled mosquitto clients against the local broker and read the password from the credentials file.

From a remote client, replace 127.0.0.1 with your VM's address (the rmqtt.host value in /root/rmqtt-credentials.txt) and pass the same username and password. Make sure the NSG port is open.

Publish a retained message on 1883, then subscribe and read it back:

PW="$(sudo grep '^rmqtt.mqtt.password=' /root/rmqtt-credentials.txt | cut -d= -f2)" mosquitto_pub -h 127.0.0.1 -p 1883 -u mqttadmin -P "$PW" -t 'demo/status' -m 'online' -r timeout 8 mosquitto_sub -h 127.0.0.1 -p 1883 -u mqttadmin -P "$PW" -t 'demo/status' -C 1

For encrypted transport, publish over TLS on 8883 and trust the per-VM certificate:

PW="$(sudo grep '^rmqtt.mqtt.password=' /root/rmqtt-credentials.txt | cut -d= -f2)" timeout 10 mosquitto_pub -h 127.0.0.1 -p 8883 --cafile /etc/rmqtt/tls/cert.pem -u mqttadmin -P "$PW" -t 'demo/secure' -m 'encrypted hello' && echo "published over TLS on 8883"

Connections that present no credentials or the wrong password are refused, because anonymous access is disabled on every listener.

Topic authorization is governed by the rmqtt-acl plugin at /etc/rmqtt/plugins/rmqtt-acl.toml. The shipped rules give loopback tools full access and let the admin user monitor the $SYS/# metrics tree. They prevent any client from subscribing to the bare # firehose, and otherwise allow authenticated clients to publish and subscribe. Edit the rules to fit your topic hierarchy, then reload the broker with sudo systemctl restart rmqtt.

To add or change the MQTT username and password, edit /etc/rmqtt/auth.env (root-only) and restart both services with sudo systemctl restart rmqtt-authd rmqtt. For larger deployments, RMQTT also ships HTTP and JWT authentication plugins that you can enable in /etc/rmqtt/rmqtt.toml.

The image ships a per-VM self-signed certificate so that TLS works out of the box. For production, install a certificate issued by a recognized authority. Place your certificate and private key on the VM, point the 8883 listener (and any WebSocket TLS listener) at them in /etc/rmqtt/rmqtt.toml, and reload:

listener.tls.external.cert = "/etc/rmqtt/tls/cert.pem" listener.tls.external.key = "/etc/rmqtt/tls/key.pem"

Replace /etc/rmqtt/tls/cert.pem and /etc/rmqtt/tls/key.pem with your issued certificate and key, keeping the key readable by the rmqtt group. Then restart the service with sudo systemctl restart rmqtt.

• Restrict the NSG. Allow 8883 (and 1883 or 8080 where you must) only from the client networks that need to connect, and allow TCP 22 for administration only.
• Prefer TLS. Use port 8883 for real traffic and install a CA-issued certificate (Step 9). Where possible, limit plaintext 1883 to traffic inside the VNet.
• Keep anonymous access disabled. Every listener requires the per-VM username and password. Add per-client credentials or an external authentication plugin as your fleet grows.
• Keep the MQTT password secret. It lives only in /root/rmqtt-credentials.txt (root-only) and /etc/rmqtt/auth.env, and it is unique to this VM. Rotate it by editing auth.env and restarting rmqtt-authd and rmqtt.
• Keep the management API private. The RMQTT HTTP API is bound to loopback (127.0.0.1:6060) and is not exposed. Keep it that way, or front it with authentication if you must reach it remotely.
• Keep the OS and RMQTT patched. Unattended security upgrades remain enabled on the running VM.

RMQTT is developed by the rmqtt project and distributed under the MIT license (dual licensed MIT OR Apache-2.0). This SecureAnyCloud image bundles the unmodified official RMQTT binary.

SecureAnyCloud provides the packaging, the secure-by-default first boot (per-VM MQTT password, per-VM TLS certificate, anonymous access disabled), the systemd integration, and 24/7 support with a guaranteed 24 hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by the RMQTT project. RMQTT is a mark of its respective owner and is used here only to identify the software.

Deploy on Azure

Find RMQTT on Ubuntu 24.04 LTS on the Azure Marketplace, published by SecureAnyCloud. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on Azure

Launch RMQTT MQTT Broker on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Find RMQTT MQTT Broker by SecureAnyCloud in the AWS Marketplace. Select Continue to Subscribe, accept the terms, then select Continue to Launch.

Choose the m5.large instance type and select your VPC, subnet and key pair. Attach a security group that opens TCP 22 for administration and TCP 8883 (MQTT/TLS). Where you need them, also open TCP 1883 (MQTT) and TCP 8080 (MQTT/WebSocket) from your client networks. Prefer 8883 for real traffic, and where possible limit plaintext 1883 to traffic inside the VPC.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rmqtt}]'

Open the MQTT and admin ports on the instance's security group (in production, restrict the source to your client networks):

for p in 22 1883 8883 8080; do aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port "$p" --cidr <your-mgmt-cidr> done

On first boot, the image resolves the instance public IP through the EC2 instance metadata service, generates a per-instance MQTT password and a per-instance self-signed TLS certificate, writes the authentication backend credential, and starts the broker. This completes within a minute.

SSH in as ubuntu and read the per-instance details, including the MQTT username and password:

sudo cat /root/rmqtt-credentials.txt

rmqtt.service and its authentication backend rmqtt-authd.service are active, and the broker listens on 1883 (TCP), 8883 (TLS) and 8080 (WebSocket).

systemctl is-active rmqtt.service rmqtt-authd.service ss -tln | grep -E ':1883|:8883|:8080'

The image ships a self-test that authenticates with the per-instance credential and completes a publish and subscribe message round trip on 1883. It confirms that a client with a wrong password and an anonymous client are both rejected, and completes a TLS handshake with an authenticated publish on 8883. Run it to verify that the broker is healthy and secure end to end:

sudo python3 /usr/local/lib/sac/rmqtt-roundtrip.py

The encrypted listener on 8883 presents the per-instance self-signed certificate. Inspect the handshake and certificate with openssl:

echo | openssl s_client -connect 127.0.0.1:8883 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Any standard MQTT client can connect with the per-instance username (mqttadmin) and password. The following examples use the bundled mosquitto clients against the local broker and read the password from the credentials file.

From a remote client, replace 127.0.0.1 with your instance's address (the rmqtt.host value in /root/rmqtt-credentials.txt) and pass the same username and password. Make sure the security group port is open.

Publish a retained message on 1883, then subscribe and read it back:

PW="$(sudo grep '^rmqtt.mqtt.password=' /root/rmqtt-credentials.txt | cut -d= -f2)" mosquitto_pub -h 127.0.0.1 -p 1883 -u mqttadmin -P "$PW" -t 'demo/status' -m 'online' -r timeout 8 mosquitto_sub -h 127.0.0.1 -p 1883 -u mqttadmin -P "$PW" -t 'demo/status' -C 1

For encrypted transport, publish over TLS on 8883 and trust the per-instance certificate:

PW="$(sudo grep '^rmqtt.mqtt.password=' /root/rmqtt-credentials.txt | cut -d= -f2)" timeout 10 mosquitto_pub -h 127.0.0.1 -p 8883 --cafile /etc/rmqtt/tls/cert.pem -u mqttadmin -P "$PW" -t 'demo/secure' -m 'encrypted hello' && echo "published over TLS on 8883"

Connections that present no credentials or the wrong password are refused, because anonymous access is disabled on every listener.

Topic authorization is governed by the rmqtt-acl plugin at /etc/rmqtt/plugins/rmqtt-acl.toml. The shipped rules give loopback tools full access and let the admin user monitor the $SYS/# metrics tree. They prevent any client from subscribing to the bare # firehose, and otherwise allow authenticated clients to publish and subscribe. Edit the rules to fit your topic hierarchy, then reload the broker with sudo systemctl restart rmqtt.

To add or change the MQTT username and password, edit /etc/rmqtt/auth.env (root-only) and restart both services with sudo systemctl restart rmqtt-authd rmqtt. For larger deployments, RMQTT also ships HTTP and JWT authentication plugins that you can enable in /etc/rmqtt/rmqtt.toml.

The image ships a per-instance self-signed certificate so that TLS works out of the box. For production, install a certificate issued by a recognized authority. Place your certificate and private key on the instance, point the 8883 listener (and any WebSocket TLS listener) at them in /etc/rmqtt/rmqtt.toml, and reload:

listener.tls.external.cert = "/etc/rmqtt/tls/cert.pem" listener.tls.external.key = "/etc/rmqtt/tls/key.pem"

Replace /etc/rmqtt/tls/cert.pem and /etc/rmqtt/tls/key.pem with your issued certificate and key, keeping the key readable by the rmqtt group. Then restart the service with sudo systemctl restart rmqtt.

• Restrict the security group. Allow 8883 (and 1883 or 8080 where you must) only from the client networks that need to connect, and allow TCP 22 for administration only.
• Prefer TLS. Use port 8883 for real traffic and install a CA-issued certificate (Step 9). Where possible, limit plaintext 1883 to traffic inside the VPC.
• Keep anonymous access disabled. Every listener requires the per-instance username and password. Add per-client credentials or an external authentication plugin as your fleet grows.
• Keep the MQTT password secret. It lives only in /root/rmqtt-credentials.txt (root-only) and /etc/rmqtt/auth.env, and it is unique to this instance. Rotate it by editing auth.env and restarting rmqtt-authd and rmqtt.
• Keep the management API private. The RMQTT HTTP API is bound to loopback (127.0.0.1:6060) and is not exposed. Keep it that way, or front it with authentication if you must reach it remotely.
• Keep the OS and RMQTT patched. Unattended security upgrades remain enabled on the running instance.

RMQTT is developed by the rmqtt project and distributed under the MIT license (dual licensed MIT OR Apache-2.0). This SecureAnyCloud image bundles the unmodified official RMQTT binary.

SecureAnyCloud provides the packaging, the secure-by-default first boot (per-instance MQTT password, per-instance TLS certificate, anonymous access disabled), the systemd integration, and 24/7 support.

SecureAnyCloud is not affiliated with or endorsed by the RMQTT project. RMQTT is a mark of its respective owner and is used here only to identify the software.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions or licensing inquiries.

Deploy on AWS

Launch RMQTT MQTT Broker from SecureAnyCloud with 24/7 support.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com